arc-project-deploy-portfolio-sync

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes scripts/project_status_check.sh to execute npm run build/lint or bun run build/lint within the target project directory. This is standard behavior for deployment automation and is controlled by the agent's local environment context.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from project source files (such as package.json and README.md) and portfolio repository HTML files to generate status updates and portfolio entries.
  • Ingestion points: Reads project configuration files and existing portfolio HTML files in the andrewsolomon.dev directory.
  • Boundary markers: None explicitly defined in the prompt instructions; the skill relies on the structured Output Contract for logical separation.
  • Capability inventory: Subprocess execution for builds, local file system writes for portfolio updates, and network access for Vercel deployment commands.
  • Sanitization: The included shell scripts use set -euo pipefail to prevent execution on errors, though the final content interpolation depends on the agent's internal safety mechanisms.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 02:19 PM
Security Audit — agent-trust-hub — arc-project-deploy-portfolio-sync